Merge pull request #377 from MySecondLanguage/permission-mutation-toggle

Permission mutation toggle

Author: MySecondLanguage

nxtbn/cart/admin_query.py

@@ -3,7 +3,7 @@
 
 from nxtbn.cart.models import Cart
 from nxtbn.cart.admin_types import CartItemType, CartType
-from nxtbn.core.admin_permissions import staff_required
+from nxtbn.core.admin_permissions import gql_staff_required
 
 
 class AdminCartQuery(graphene.ObjectType):
@@ -13,18 +13,18 @@ class AdminCartQuery(graphene.ObjectType):
 
     items_in_cart = graphene.List(CartItemType, cart_id=graphene.ID(required=True))
 
-    @staff_required
+    @gql_staff_required
     def resolve_carts(self, info, **kwargs):
         return Cart.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_cart_by_user(self, info, user_id):
         try:
             return Cart.objects.get(user_id=user_id)
         except Cart.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_items_in_cart(self, info, cart_id):
         try:
             cart = Cart.objects.get(id=cart_id)

nxtbn/core/admin_permissions.py

@@ -6,6 +6,7 @@
 
 import functools
 from graphql import GraphQLError
+
 class GranularPermission(BasePermission):
     def get_permission_name(self, model_name, action):
 
@@ -18,19 +19,23 @@ def has_permission(self, request, view):
         if request.user.is_superuser:
             return True
 
-        if request.user.method in SAFE_METHODS and request.user.is_staff: # Every staff can view
+        if request.method in SAFE_METHODS and request.user.is_staff: # Every staff can view
             return True
 
-        model_name = view.queryset.model.__name__.lower()  # Get model name dynamically
-        action = view.action.required_perm
+        model_cls = getattr(view, 'queryset', None) or getattr(view, 'model', None)
+        if model_cls is None:
+            return False
+
+        model_name = model_cls.__name__.lower()
+        action = view.required_perm
 
         permission_name = self.get_permission_name(model_name, action)
 
         # Check if the user has the generated permission
         return request.user.has_perm(permission_name)
 
 
-class ModelPermissions(BasePermission):
+class CommonPermissions(BasePermission):
 
     def has_permission(self, request, view):
         if not request.user.is_authenticated:
@@ -39,12 +44,12 @@ def has_permission(self, request, view):
         if request.user.is_superuser:
             return True
 
-        if request.user.method in SAFE_METHODS and request.user.is_staff: # Every staff can view
+        if request.method in SAFE_METHODS and request.user.is_staff: # Every staff can view
             return True
 
 
 
-        model_cls = getattr(view, 'queryset', None)
+        model_cls = getattr(view, 'queryset', None) or getattr(view, 'model', None)
         if model_cls is None:
             return False
 
@@ -70,7 +75,7 @@ def has_permission(self, request, view):
 
 
 
-def required_perm(code: str): # Used in graphql only
+def gql_required_perm(code: str): # Used in graphql only
     def decorator(func):
         @functools.wraps(func)
         def wrapper(self, info, *args, **kwargs):
@@ -95,7 +100,7 @@ def wrapper(self, info, *args, **kwargs):
     return decorator
 
 
-def staff_required(func):
+def gql_staff_required(func): # Used in graphql only
     @functools.wraps(func)
     def wrapper(self, info, *args, **kwargs):
         user = info.context.user

nxtbn/core/admin_queries.py

@@ -3,7 +3,7 @@
 from graphql import GraphQLError
 
 from nxtbn.core import CurrencyTypes
-from nxtbn.core.admin_permissions import staff_required
+from nxtbn.core.admin_permissions import gql_staff_required
 from nxtbn.core.admin_types import AdminCurrencyTypesEnum, CurrencyExchangeType
 from nxtbn.core.models import CurrencyExchange
 from graphene_django.filter import DjangoFilterConnectionField
@@ -14,7 +14,7 @@ class AdminCoreQuery(graphene.ObjectType):
     currency_exchange = graphene.Field(CurrencyExchangeType, id=graphene.ID(required=True))
     allowed_currency_list = graphene.List(AdminCurrencyTypesEnum)
 
-    @staff_required
+    @gql_staff_required
     def resolve_currency_exchanges(self, info, **kwargs):
         return CurrencyExchange.objects.all()
 
@@ -24,7 +24,7 @@ def resolve_currency_exchange(self, info, id):
         except CurrencyExchange.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_allowed_currency_list(self, info):
         allowed_currency_list = settings.ALLOWED_CURRENCIES
 

nxtbn/order/admin_queries.py

@@ -1,7 +1,7 @@
 import graphene
 from graphene_django.filter import DjangoFilterConnectionField
 
-from nxtbn.core.admin_permissions import staff_required
+from nxtbn.core.admin_permissions import gql_staff_required
 from nxtbn.order.admin_types import OrderType
 from nxtbn.order.models import Address, Order
 from nxtbn.users import UserRole
@@ -13,11 +13,11 @@ class AdminOrderQuery(graphene.ObjectType):
 
 
 
-    @staff_required
+    @gql_staff_required
     def resolve_orders(self, info, **kwargs):
         return Order.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_order(self, info, id):
         try:
             order = Order.objects.get(id=id)

nxtbn/order/api/dashboard/views.py

@@ -21,7 +21,8 @@
 import django_filters
 from django_filters import rest_framework as filters
 
-from nxtbn.core.admin_permissions import GranularPermission
+from nxtbn.core.admin_permissions import GranularPermission, CommonPermissions
+from nxtbn.core.enum_perms import PermissionsEnum
 from nxtbn.core.utils import to_currency_unit
 from nxtbn.order.proccesor.views import OrderProccessorAPIView
 from nxtbn.order import OrderAuthorizationStatus, OrderChargeStatus, OrderStatus, ReturnStatus
@@ -90,6 +91,7 @@ def filter_max_order_value(self, queryset, name, value):
 
 
 class OrderListView(generics.ListAPIView):
+    permission_classes = (CommonPermissions, )
     queryset = Order.objects.all()
     serializer_class = OrderListSerializer
     pagination_class = NxtbnPagination
@@ -103,10 +105,9 @@ class OrderListView(generics.ListAPIView):
     search_fields = ['alias', 'id', 'user__username', 'supplier__name']
     ordering_fields = ['created_at']
 
-    role_action = 'list'
-
 
 class OrderDetailView(generics.RetrieveAPIView):
+    permission_classes = (CommonPermissions, )
     queryset = Order.objects.all()
     serializer_class = OrderDetailsSerializer
     lookup_field = 'alias'
@@ -130,7 +131,7 @@ class OrderDetailView(generics.RetrieveAPIView):
 
 
 class BasicStatsView(APIView):
-
+    permission_classes = (CommonPermissions, )
     def get(self, request):
         # Get start and end dates from query parameters
         start_date_str = request.query_params.get('start_date')
@@ -217,6 +218,7 @@ def get(self, request):
 
 
 class OrderOverviewStatsView(APIView):
+    permission_classes = (CommonPermissions, )
     """
     View to provide an overview of order statistics within a specified date range.
     Methods:
@@ -310,7 +312,7 @@ def get(self, request):
 
 
 class OrderSummaryAPIView(APIView):
-
+    permission_classes = (CommonPermissions, )
     def get(self, request, *args, **kwargs):
         time_period = request.query_params.get('time_period')  # 'year', 'month', 'week', 'day'
         current_date = datetime.now()
@@ -392,12 +394,20 @@ def get(self, request, *args, **kwargs):
 
         return Response(formatted_data)
 class OrderEastimateView(OrderProccessorAPIView):
-    permission_classes = (GranularPermission, )
-    required_perm = 'order.eastimate_order'
-
     create_order = False # Eastimate order
 
+    def check_permissions(self, request):
+        if not request.user.is_staff:
+            self.permission_denied(
+                request,
+                message=_("You do not have permission to perform this action."),
+                code='permission_denied'
+            )
+
 class OrderCreateView(OrderProccessorAPIView):
+    model = Order
+    permission_classes = (GranularPermission, )
+    required_perm = 'add_order'
     create_order = True # Eastimate and create order
 
 class CreateCustomAPIView(generics.CreateAPIView):

nxtbn/product/admin_queries.py

@@ -3,7 +3,7 @@
 import graphene
 
 from graphene_django.filter import DjangoFilterConnectionField
-from nxtbn.core.admin_permissions import staff_required
+from nxtbn.core.admin_permissions import gql_staff_required
 from nxtbn.product.admin_types import CategoryTranslationType, CategoryType, CollectionTranslationType, CollectionType, ProductGraphType, ProductTagTranslationType, ProductTagType, ProductTranslationType, ProductVariantAdminType, SupplierType
 from nxtbn.product.models import Category, CategoryTranslation, Collection, CollectionTranslation, Product, ProductTag, ProductTagTranslation, ProductTranslation, Supplier
 from nxtbn.users import UserRole
@@ -42,114 +42,114 @@ class ProductQuery(graphene.ObjectType):
     tags_translations = DjangoFilterConnectionField(ProductTagTranslationType)
 
 
-    @staff_required
+    @gql_staff_required
     def resolve_product(root, info, id):
 
         try:
             return Product.objects.get(pk=id)
         except Product.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_products(root, info, **kwargs):
         return Product.objects.all()
 
 
-    @staff_required
+    @gql_staff_required
     def resolve_collection(root, info, id):
 
         try:
             return Collection.objects.get(pk=id)
         except Collection.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_collections(root, info, **kwargs):
         return Collection.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_producttag(root, info, id):
 
         try:
             return ProductTag.objects.get(pk=id)
         except ProductTag.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_producttags(root, info, **kwargs):
         return ProductTag.objects.all()
 
 
-    @staff_required
+    @gql_staff_required
     def resolve_supplier(root, info, id):
 
         try:
             return Supplier.objects.get(pk=id)
         except Supplier.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_suppliers(root, info, **kwargs):
         return Product.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_product_variants(root, info, **kwargs):
         return Product.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_category(root, info, id):
 
         try:
             return Category.objects.get(pk=id)
         except Category.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_categories(root, info, **kwargs):
         return Category.objects.all()
 
     # All translations
-    @staff_required
+    @gql_staff_required
     def resolve_category_translation(root, info, base_category_id, lang_code):
         try:
             return CategoryTranslation.objects.get(category_id=base_category_id, language_code=lang_code)
         except CategoryTranslation.DoesNotExist:
             return None
-    @staff_required
+    @gql_staff_required
     def resolve_category_translations(root, info, **kwargs):
         return CategoryTranslation.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_collection_translation(root, info, base_collection_id, lang_code):
         try:
             return CollectionTranslation.objects.get(collection_id=base_collection_id, language_code=lang_code)
         except CollectionTranslation.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_collection_translations(root, info, **kwargs):
         return CollectionTranslation.objects.all()
 
-    @staff_required
+    @gql_staff_required
     def resolve_tags_translation(root, info, base_tag_id, lang_code):
         try:
             return ProductTagTranslation.objects.get(tag_id=base_tag_id, language_code=lang_code)
         except ProductTagTranslation.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_tags_translations(root, info, **kwargs):
         return ProductTagTranslation.objects.all()
 
 
-    @staff_required
+    @gql_staff_required
     def resolve_product_translation(root, info, base_product_id, lang_code):
         try:
             return ProductTranslation.objects.get(product_id=base_product_id, language_code=lang_code)
         except ProductTranslation.DoesNotExist:
             return None
 
-    @staff_required
+    @gql_staff_required
     def resolve_product_translations(root, info, **kwargs):
         return ProductTranslation.objects.all()